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Statement of Policy Regarding the Removal of Data on Cisco Equipment 


Introduction 


This statement of policy explains Cisco's general practices for handling products as part of Cisco’s return, repair, 
and disposal processes. It also provides guidance to customers for removing data (as defined below) from Cisco 
products before customers dispose of such products or return them to Cisco. 


Definition 
“Data” used in this statement of the policy means any data, facts or other information generated or collected by a 
customer, including but not limited to information that enables identification of an individual, such as a name, email 


address, title, occupation, industry, telephone number, employer, a home, postal or other physical address, other 
contact information, birth date, or gender. 


"Data" can also include financial or other information relating to an identified or identifiable individual by direct or 
indirect means, including a social security number, driver's license number, credit card number, account number, 
password and similar information, and any data identifying racial or ethnic origin, religious, philosophical or other 
beliefs, political opinions, membership of parties, trade unions, associations or organizations of a religious, 
philosophical, political or trade-union character, records of criminal offenses, and health conditions and sexual 
behaviors. 


Cisco Procedures in Handling Returned and Scrap Equipment 


It is the customer's responsibility to remove data from products before such products are returned to Cisco. Cisco 
bears no responsibility for the protection, safeguarding or return of any data left on the products that have been 
returned to Cisco. However, after a customer has returned a product to Cisco, Cisco takes the following general 
measures, as part of Cisco’s internal repair and disposal processes for such products: 


Memory 


For Cisco products with memory, Cisco will clear and reset the nonvolatile random-access memory (NVRAM). 


Cisco OS and configuration settings 


For Cisco products with any OS and configuration settings, Cisco will (a) erase the current software and install the 
default OS on the product and (b) erase any customer’s information and passwords. 


Disk drives 


For Cisco products with disk drives, Cisco will reformat the hard drives and reinstall the default configuration 
settings. 


Products damaged beyond repair 


For Cisco products deemed damaged beyond repair, Cisco will physically shred products or use other methods 
that render such products unusable for their intended purpose. Cisco will not provide the certificate of destruction. 
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Storage of products pending processing 


Before Cisco products are processed as set forth above, Cisco will hold such products in a secured warehouse or 
other storage facility in accordance with Cisco and industry standards. 


UCS Drive Retention Service 
Customers concerned about retention of secured data on defective UCS drives may opt to purchase the UCS Drive 


Retention Service. Please contact your account representative for more information. 


Requirements for Customer Removal of Data 


Below are Cisco's requirements that customers must follow when removing data from equipment before disposal or 
return to Cisco. Product documentation can be found on Cisco.com. 


Memory 
For Cisco products with memory, customers must clear and reset all memory content. 
Please refer to product specific documentation for clearing memory content. 


Cisco OS and configuration settings 


For Cisco products with any OS and configuration settings, customers must clear and reset all memory content 
(including any flash memory). 


Please refer to product specific documentation for clearing memory content. 
Disk drives 
For Cisco products with disk drives, customers are responsible for removing their data. 


It is recommended that customers use current industry tools and methodologies to remove data. 


Exceptions 


Procedure for Approval for Destruction of Defective Equipment: 


Defective parts must be returned within 10 calendar days of ship date of the replacement part(s). For defective 
parts which are not returned within 30 calendar days after shipment of the replacement parts, Cisco reserves the 
right to charge for liquidated damages equivalent to the current full list price of the parts. 


In general destruction of parts instead of return is not allowed. However, case by case exceptions will be 
considered if data security is at potential risk. 


Approval will only be considered based on the following: 
1. The defective parts cannot be returned due to data security or the defective parts are covered under a UCS 
Drive Retention contract 


2. The customer receives prior approval from Cisco using the authorized Asset Destruction Approval Request 
form 
“To request an Asset Destruction Approval form, please contact your local Asset Recovery Organization A 

3. The customer agrees to make payment to Cisco for the list price of the part(s) to be destroyed minus the 
standard product discount 


If the customer destroys parts without prior approval, Cisco reserves the right to charge for liquidated damages 
equivalent to the current full list price of the parts. 
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Related Policies and Processes 
This policy is intended to support and be consistent with other relevant Cisco policies, including: 


e Cisco's Third-Party Repair Sources: Cisco Warranty and Service Support Implications 


e Cisco’s Return Material Authorization Instructions 


e Cisco's Privacy Statement and other privacy and data protection policies located at: http://www.cisco.com 
The information set forth in this statement of policy is provided "as is" and is not considered as a warranty or 


guarantee of any kind. 
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